|
|
|
|
SSH Keywords
|
|
|
|
|
============
|
|
|
|
|
|
|
|
|
|
Suricata comes with several rule keywords to match on SSH connections.
|
|
|
|
|
|
|
|
|
|
ssh.proto
|
|
|
|
|
---------
|
|
|
|
|
|
|
|
|
|
Match on the version of the SSH protocol used.
|
|
|
|
|
|
|
|
|
|
Example::
|
|
|
|
|
|
|
|
|
|
alert ssh any any -> any any (msg:"match SSH protocol version"; \
|
|
|
|
|
ssh.proto; content:"2.0"; sid:1000010;)
|
|
|
|
|
|
|
|
|
|
The example above matches on SSH connections with SSH version 2.
|
|
|
|
|
|
|
|
|
|
``ssh.proto`` is a 'Sticky buffer'.
|
|
|
|
|
|
|
|
|
|
``ssh.proto`` can be used as ``fast_pattern``.
|
|
|
|
|
|
|
|
|
|
``ssh.proto`` replaces the previous keyword name: ``ssh_proto``. You may continue
|
|
|
|
|
to use the previous name, but it's recommended that rules be converted to use
|
|
|
|
|
the new name.
|
|
|
|
|
|
|
|
|
|
ssh.software
|
|
|
|
|
------------
|
|
|
|
|
|
|
|
|
|
Match on the software string from the SSH banner.
|
|
|
|
|
|
|
|
|
|
Example::
|
|
|
|
|
|
|
|
|
|
alert ssh any any -> any any (msg:"match SSH software string"; \
|
|
|
|
|
ssh.software: content:"openssh"; nocase; sid:1000020;)
|
|
|
|
|
|
|
|
|
|
The example above matches on SSH connections where the software string contains "openssh".
|
|
|
|
|
|
|
|
|
|
``ssh.software`` is a 'Sticky buffer'.
|
|
|
|
|
|
|
|
|
|
``ssh.software`` can be used as ``fast_pattern``.
|
|
|
|
|
|
|
|
|
|
``ssh.software`` replaces the previous keyword name: ``ssh_software``. You may continue
|
|
|
|
|
to use the previous name, but it's recommended that rules be converted to use
|
|
|
|
|
the new name.
|
|
|
|
|
|
|
|
|
|
ssh.protoversion
|
|
|
|
|
----------------
|
|
|
|
|
|
|
|
|
|
This is a legacy keyword. Use ``ssh_proto`` instead!
|
|
|
|
|
|
|
|
|
|
Match on the version of the SSH protocol used.
|
|
|
|
|
|
|
|
|
|
Example::
|
|
|
|
|
|
|
|
|
|
alert ssh any any -> any any (msg:"match SSH protocol version"; \
|
|
|
|
|
ssh.protoversion:"2.0"; sid:1000030;)
|
|
|
|
|
|
|
|
|
|
ssh.softwareversion
|
|
|
|
|
-------------------
|
|
|
|
|
|
|
|
|
|
This is a legacy keyword. Use ``ssh_software`` instead!
|
|
|
|
|
|
|
|
|
|
Match on the software string from the SSH banner.
|
|
|
|
|
|
|
|
|
|
Example::
|
|
|
|
|
|
|
|
|
|
alert ssh any any -> any any (msg:"match SSH software string"; \
|
|
|
|
|
ssh.softwareversion:"OpenSSH"; sid:10000040;)
|
